Just when you thought crypto market morale couldn’t sink any lower, along comes the Coldcard entropy bug to prove you wrong.
The discovery of a flaw in one of the industry’s longest-running hardware wallets last Friday serves as a stark reminder that there is no perfectly safe place to put all your Bitcoin.
Coldcard disclosed the entropy-generation flaw affecting multiple Coldcard devices on July 31. Since then, researchers at Galaxy Digital say attackers have been able to steal more than 1,596 Bitcoin worth at least $100 million through several coordinated attacks.
Wallet manufacturers are now being forced to explain a process most users never even think about: how their wallet generates the private key to protect their Bitcoin.
Michael Tanguma, head of product at Bitcoin custody firm Onramp Bitcoin, tells Magazine:
“The whole model rests on trust that the vendor got it right […] Almost no individual can audit the hardware, the firmware and the entropy generation underneath their device.”
Coinkite, the company behind Coldcard, has released firmware fixes and told affected users to migrate their funds, but the incident has shaken Bitcoin HODLers to the core, and it raises an uncomfortable question:
If Coldcard wallets can be exploited, does that mean all hardware wallets are potentially insecure?
A bug hidden in the foundations
The Coldcard vulnerability did not exploit Bitcoin itself nor break modern cryptography, but it struck at something much more fundamental: randomness.
Every Bitcoin wallet begins by generating a seed phrase from a pool of random data, which means that randomness should be sufficiently unpredictable to make the resulting private keys effectively impossible to guess. Entropy refers to how random it is.
If that randomness is weakened for any reason, attackers can reduce the number of possible keys that could be generate and eventually find a way to reproduce them.
Related: Coldcard hack sparks biggest sub-1 BTC move since FTX: CryptoQuant
Coinkite first alerted users on July 31 that wallets created on affected firmware should be considered at risk and told customers to migrate funds to newly generated wallets. As researchers dug further into the bug over the following days, their attention quickly turned to how a flaw in such a critical part of the wallet had gone unnoticed for more than five years.
Core Lightning developer Dustin Dettmer suggested that it might have originated during firmware changes made in 2021.
He believes that code intended to interface with the hardware random number generator instead disabled it, which caused wallet creation to fall back to MicroPython’s weaker Yasmarang pseudo-random number generator.
His theory has become one of the leading explanations for how the bug may have entered production firmware, although Coinkite has not confirmed that exact sequence of events, and says that it will publish a full technical postmortem “soon.” A Coinkite spokesperson tells Magazine:
“Certain firmware versions had a fallback path in seed generation that could produce weak entropy when generated on the device firmware itself.”
Devices where users generated their own entropy through dice rolls or similar manual methods “were not affected by this specific fallback path,” the spokesperson says.
Weak random number generation (RNG) is not unprecedented, but unlike many other security flaws, it is difficult to detect.
Bitcoin security expert Jameson Lopp noted that RNG vulnerabilities have previously affected a long list of cryptocurrency wallets and libraries, ranging from Blockchain.com’s Android wallet to Trust Wallet.
Weak random number generation is not a new problem. Source: Jameson Lopp
Ledger director of product security Vincent Bouzon tells Magazine that “weak randomness passes output tests,” which means that compromised random-number generators can still produce values that appear random, making flaws difficult to identifiy.
Different wallets, different randomness assumptions
Hardware wallet manufacturers agree that secure entropy generation is non-negotiable, but they take different approaches to achieving it.
Related: Zilliqa Ledger app vulnerability lets attackers recover signer’s private keys
Ledger’s philosophy centers on dedicated security hardware. Bouzon says Ledger devices generate seeds using a true random number generator embedded in a certified Secure Element. The entropy source is certified under the AIS-31 PTG.2 standard and the Secure Element undergoes Common Criteria certification. He says:
“This Coldcard incident was a failure in one specific implementation, not a verdict on secure self-custody […] The generation of that entropy must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.”
Generating high-quality randoness is where the whole thing lives or dies. Source: Charles Guillemet
For its part, Trezor combines randomness generated inside the device…
cointelegraph.com